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DATA PROTECTION ACT 1998 
AND 
PRIVACY AND ELECTRONIC COMMUNICATIONS (EC DIRECTIVE) 
REGULATIONS 2003 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


To: The Conservative Party 


Of: 4 Matthew Parker Street, London, SW1H 9HQ 


1. The Information Commissioner ("the Commissioner”) has decided to 
issue the Conservative Party ("the Party”) with a monetary penalty 
under section 55A of the Data Protection Act 1998 ("DPA”), as 
amended by Schedule 1 to the Privacy and Electronic Communications 
(EC Directive) Regulations 2003 ("PECR”). The penalty is in relation to 
a serious contravention of regulation 22 of PECR. 


2: This notice explains the Commissioner's decision. 
Legal framework 

3: The Party is the organisation stated in this notice to have transmitted 
unsolicited communications by means of electronic mail to individual 
subscribers for the purposes of direct marketing contrary to regulation 


22 of PECR. 


4. Regulation 22 of PECR states: 
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“(1) This regulation applies to the transmission of unsolicited 
communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person's similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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Section 122(5) of the Data Protection Act 2018 (“DPA18”) defines 
direct marketing as “the communication (by whatever means) of any 
advertising material which is directed to particular individuals”. This 
definition also applies for the purposes of PECR (see regulation 2(2) 
PECR and paragraphs 430 & 432(6) to Schedule 19 of the DPA18). It is 
well-established that direct marketing encompasses communications 


promoting political parties and aims: Scottish National Party v 
Information Commissioner (EA/2005/0021). 


Consent in PECR is defined, from 29 March 2019, by reference to the 
concept of consent in Regulation 2016/679 (“the GDPR”): regulation 
8(2) of the Data Protection, Privacy and Electronic Communications 
(Amendments etc) (EU Exit) Regulations 2019. Article 4(11) of the 
GDPR sets out the following definition: “‘consent’ of the data subject 
means any freely given, specific, informed and unambiguous indication 
of the data subject's wishes by which he or she, by a statement or by a 
clear affirmative action, signifies agreement to the processing of 


personal data relating to him or her”, 
That is further supplemented by Article 7 GDPR, which provides: 


“1. Where processing is based on consent, the controller shall be able 
to demonstrate that the data subject has consented to processing of 


his or her personal data. 


2. If the data subject's consent is given in the context of a written 
declaration which also concerns other matters, the request for consent 
shall be presented in a manner which is clearly distinguishable from the 
other matters, in an intelligible and easily accessible form, using clear 
and plain language. Any part of such a declaration which constitutes an 


infringement of this Regulation shall not be binding. 
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3. The data subject shall have the right to withdraw his or her 
consent at any time. The withdrawal of consent shall not affect the 
lawfulness of processing based on consent before its withdrawal. Prior 


to giving consent, the data subject shall be informed thereof. It shall 


be as easy to withdraw as to give consent. 


4. When assessing whether consent is freely given, utmost account 
shall be taken of whether, inter alia, the performance of a contract, 
including the provision of a service, is conditional on consent to the 
processing of personal data that is not necessary for the performance 


of that contract.” 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail” is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 


“(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that — 
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(a) there has been a serious contravention of the requirements 


of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that the 


contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C(1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO's website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implements Directive 2002/58/EC, and Directive 2009/1 36/EC 
which amended the earlier Directive. Both the Directive and PECR are 
“designed to protect the privacy of electronic communications users”: 
Leave.EU & Eldon Insurance Services v Information Commissioner 
[2021] UKUT 26 (AAC) at paragraph 26. The Commissioner seeks to 
interpret and apply PECR in a manner consistent with the purpose of 
the Directive and PECR of ensuring a high level of protection of the 
privacy of individuals, and in particular the protections provided from 
receiving unsolicited direct marketing communications which the 


individual has not consented to receive. 
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The provisions of the DPA remain in force for the purposes of PECR 


notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


Background to the case 


On 23 July 2019, the Rt Hon Boris Johnson MP was elected leader of 


the Party, and was appointed Prime Minister of the United Kingdom. 


The following day, 24 July 2019, the Party commenced an eight day 
email marketing campaign which ran until 31 July 2019. The emails 
were sent in the name of the Prime Minister. They were addressed to 
the individual recipient by name and promoted the Party’s political 
priorities stating: “With Brexit out the way, we'll invest in our NHS. 
Giving GP surgeries and hospitals the resources they need. We'll invest 
in our schools. So every child has the opportunity to succeed. We'll 
give young people the chance to buy their own home. And we'll get a 
grip on rising crime — with an extra 20,000 police officers. So they can 
get out on the streets and keep us safe. This is what I'll do — but I 
need your support. If you want to get our country back on the road to 
a brighter future, then join me and help make it happen.” The last 
sentence of the email contained a hyperlink which redirected 
individuals to https://www.conservatives.com/join. The website listed 


three types of membership subscriptions. 


Between 24 July and 31 July 2019, the Party sent out a total of 
1,190,280 direct marketing emails. 


During the same period, the Commissioner received 51 complaints 
from individuals who had received the Party’s email but who did not 


consider that they had consented to do so. As a result of the high level 
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of complaints received within a short space of time, supplemented by 
contemporaneous media reporting, the Commissioner commenced an 


investigation into the Party's compliance with PECR, writing to the 
Party on 2 August 2019. 


The Commissioner specific responses from the Party in relation to the 


51 individuals who had complained to her. 


The Party's responses indicated that in 12 cases, the Party had wrongly 
failed to give effect to a request to unsubscribe from its direct 
marketing communications. This was said to be because the Party had 
recently changed its bulk email provider and the transfer of records 
had not been effected properly. The Party has been unable to provide 
any further information or detail about this issue because it says that 
the relevant employee left shortly afterwards and there are no 
available records. Any direct marketing email sent to an individual who 


has unsubscribed is a clear breach of regulation 22 of PECR. 


In a further 7 cases, no basis of consent was recorded; for 3 the email 
addresses were not found; in 2 cases the email address was said to 
have been recorded against the incorrect person and in another 2 
records provided only a bare reference to "verbal consent” having been 
provided. In one case the Party was unable to access the consent 


record and in another the source was recorded as unknown. 


The largest category was given as 18 of the individuals who were said 
to have responded to surveys, with a further 5 said to have subscribed 
to newsletters. The emails sent in July 2019 were not newsletters: they 
were direct marketing communications to set out the Party's political 


message and to encourage recipients to join the Party. 
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Moreover, the Commissioner's investigation identified that the surveys 
and sign-up pages relied upon by the Party required the provision of an 
email address in order to participate, and those completing the survey 
were not given the option to opt out of receiving direct marketing 
communications (whether by email or other formats). This did not 


constitute freely given consent within the meaning of the GDPR and 
PECR. 


Although on at least one occasion during her investigation, the Party 
suggested to the Commissioner that the surveys used to collect 
personal data were on an ‘opt in’ basis, the Commissioner’s own testing 
established that the supply of an email address was a requirement of 
participation. That test occurred, in October 2019, after the Party had 
stated on 21 September 2019 that completion of name and email 
information had been made optional. In correspondence of 28 February 
2020, the Party confirmed that this change was only made after the 


Commissioner’s investigation had begun. 


Further, and in any event, the information provided to the individual 
participating in the survey did not, in many of the instances provided to 
the Commissioner, sufficiently clearly inform the reader that their email 
address would be used to send direct marketing communications to 
further the political aims of the Party. It cannot be assumed that all 
participants in online surveys operated by or on behalf of the Party will 
share the Party’s political position: some may participate because they 
have diametrically opposed political views which they wish to 
emphasise to the Party and who would not wish to receive direct 
marketing on behalf of the Party having done so. Consent was not 
sufficiently specific and informed to comply with the requirements of 
the GDPR and PECR as a result. 
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Following a request from the Commissioner, the Party explained ina 
letter dated 3 November 2020 that it was unable to provide evidence of 
the consent for each of the 1,190,280 emails it had sent in July 2019 
because its email lists are now “updated constantly with additions and 
removals”. The Party was accordingly unable to comply with its 
obligation under Article 7(1) GDPR to demonstrate that the data 
subject has consented the processing of their personal data in 


question. 


In an email of 12 January 2021, the Party provided further information 
to the Commissioner. It explained that the 1,190,280 emails consisted 
of three email campaigns. Two were to Party members only, which 
accounted for 427,500 (the membership mailing list being 213,750). 
The third was to both members and non-members, in the total number 
of 762,780. Accordingly, the number of non-Party members who 
appear to have received emails from the Party in the relevant time 
period will have been approximately 549,030. The Party noted that 
some of these recipients may have received the email more than once, 
if they had provided multiple email addresses, but accepted that this 
would only cause a “marginal reduction” in the number of individual 


recipients. 


The Party is unable to provide consent information in relation to the 
549,030 non-member recipients. It asserts that its 213,750 members 


have consented to receive emails from the Party. 


The Commissioner’s investigation extended over a lengthy period of 


time for a number of reasons. 


First, the Party repeatedly failed to provide responses within time 


periods set, even when those periods were extended. The 
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Commissioner does not consider that this was satisfactory compliance 


with reasonable requests from the statutory regulator. 


Second, the Commissioner had been simultaneously engaging with the 
Party in detail in relation to its data protection and privacy compliance 
in work arising out of her data analytics investigation, in which all 
major political parties had been the subject of data protection audits. 
That work identified that the Party lacked appropriate policies and 
procedures to aid compliance, but it continued to engage in large-scale 


email marketing exercises without having completed its remedial work. 


Third, various other direct marketing campaigns conducted by the 
Party were also the subject of complaints which required related 
investigation. In particular, the extensive email direct marketing 
conducted by the Party as part of its 2019 General Election campaign 
involved the transmission of 22,950,984 emails between 1 October and 
13 December 2019, about which the Commissioner also received a 
large number of complaints. The Commissioner has not in this Notice 
sought to identify the use of email direct marketing during the General 
Election campaign as a further contravention, because she recognises 
that to some extent during this period some of the sign-up processes 
and consent wording used by the Party appears to have been 
improved, in particular as a result of the Commissioner’s work with the 
Party. Nonetheless, she considers it a matter of real concern that such 
large scale processing occurred during her ongoing investigation and 
before the Party had taken all the steps necessary to ensure that its 
processing, and database of individuals who would receive emails, was 
fully compliant with the GDPR and with PECR. 
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The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute 
a contravention of regulation 22 of PECR by the Party and, if so, 


whether the conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that the Party contravened regulation 22 of 
PECR. 


The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 24 and 31 July 2019 there were 
51 direct marketing electronic communications received by individuals 
who then complained to the Commissioner. The Commissioner finds 
that the Party transmitted the direct marketing messages sent and 


complained about, contrary to regulation 22 of PECR. 


The Party, as the sender of the direct marketing, is required to ensure 
that it is acting in compliance with the requirements of regulation 22 of 
PECR, and to ensure that valid consent to send those messages had 


been acquired. 


In this instance, the Commissioner finds that the 51 emails which were 
the subject of complaints to her can be clearly identified as having 
been sent without valid consent and therefore contravened regulation 
22 of PECR. In many instances, no evidenced consent could be 
provided at all, including some cases where the individual had 


specifically unsubscribed. In other instances, the consent process relied 
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upon by the Party did not meet the standards required by the GDPR 


and by PECR: it was not freely given, specific or informed. 


The Commissioner has not made a finding that all 1,190,280 emails 
sent during the contravention period were sent in breach of PECR. She 
has not done so because the Party has not been able to provide 
sufficient or clear evidence as to the extent to which lawful and valid 
consent was provided for all of those emails. She accepts that it is 
likely that some proportion of the emails will have been likely to be 
validly sent under regulation 22, but that it is not possible to identify 
what that proportion is. In particular, she accepts that it is likely that 
Party members will have consented to receive such emails, but that 
still leaves 549,030 non-members for which individualised 


consideration of the purported consent would be required. 


The Commissioner has similarly considered making a further formal 
finding of contravention of Article 7(1) GDPR by reference to the 
Party's inability to evidence the consent of the data subject upon which 
it purports to have relied in July 2019. She has concluded that the 
preferable and proportionate course is restrict this Notice to one issued 


under PECR alone. 


However, both the failure to comply with Article 7(1) and the extensive 
number of emails sent during the contravention period, have been 
taken into account by the Commissioner in her decision-making, as set 


out elsewhere in this Notice. 


The Commissioner is therefore satisfied from the evidence she has 
seen that the Party did not have the necessary valid consent for the 51 
direct marketing emails received by individuals who then complained to 


the Commissioner. 
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The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 


Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 
above was serious. This is because 51 direct marketing email 
communications were sent by the Party which did not comply with 
regulation 22 of PECR and were the subject of complaints to the 
Commissioner. These messages contained political direct marketing 


material for which subscribers had not provided consent. 


The serious nature of the contravention extends significantly wider 
than the number of complaints. In particular, the Commissioner has 


had regard to: 


(1) The Party's failure to comply with the requirements of Article 7(1) 
GDPR; 


(2) The very significant number of emails sent in an eight day period, 


being over 1 million; 


(3) The 549,030 recipients who are non-Party members for which no 


clear records of consent are available; 
(4) The acknowledged absence of any relevant written policies. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 


Deliberate or negligent contraventions 
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The Commissioner has considered whether the contravention identified 
above was deliberate. 


The Commissioner does not consider that there is sufficient evidence to 
find that the Party deliberately set out to contravene PECR in this 


instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


First, she has considered whether the Party knew or ought reasonably 
to have known that there was a risk that the contravention would 
occur. This is not a high threshold: Leave.EU, paragraph 88. She is 
satisfied that this condition is met. The Party lacked written policies 
addressing PECR and such internal training material as it did have 
appears to have taken the manifestly incorrect view that the Party's 
legitimate interests would be sufficient to justify direct marketing of 
this type. The transfer of its bulk email provider and the loss of 
unsubscribe records as a result gave rise to an obvious and clear risk of 
contravention about which no steps appear to have been taken at the 


time. 


The Commissioner has published detailed guidance for those carrying 
out direct marketing explaining their legal obligations under PECR. 
This guidance gives clear advice regarding the requirements of consent 
for direct marketing, including in the political context, and explains the 
circumstances under which organisations are able to carry out 
marketing over the phone, by text, by email, by post, or by fax. In 


particular it states that organisations can generally only send, or 
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instigate, marketing emails to individuals if that person has specifically 
consented to receiving them. There is no indication or evidence that 


the Party had had any regard to this guidance prior to the 


contravention. 


Moreover, the Party was at the time the subject of detailed 
engagement with the Commissioner and was aware that the 
Commissioner had identified various respects in which its compliance 
with data protection and privacy law fell short of the standards 


expected. 


It is therefore reasonable to suppose that the Party should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether the Party 
failed to take reasonable steps to prevent the contraventions. Again, 


she is satisfied that this condition is met. 


In particular, the Commissioner considers that any person wishing to 
engage in direct marketing by email could and should - particularly 
since the coming into effect of the GDPR - have ensured that all of 
their consent capture mechanism properly enabled consent to be 
separately given or withheld for direct marketing communications, and 
that the privacy information provided was specific and clear as to what 
sort of communications would be sent and for what purpose. The Party 
did not do this. Moreover, the Party could and should have ensured 
that it had and retained clear records of the basis upon which it 
claimed that an individual had consented to receiving direct marketing 


communications, as required by Article 7(1). It did not do so. 


In the circumstances, the Commissioner is satisfied that the Party 


failed to take reasonable steps to prevent the contraventions. 
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The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commisioner’s decision to issue a monetary penalt 


Although the contravention has been identified as 51 emails having 
been sent by the Party in breach of regulation 22 of PECR, the 
Commissioner nonetheless considers that it is an appropriate case to 
impose a monetary penalty, and to set the penalty in the sum 
specified. In reaching that conclusion, the Commissioner has taken into 


account the following aggravating features of this case. 


(1) The Party has failed to comply with its obligation in Article 7(1) 
GDPR to be able to demonstrate the consent of the data subjects 
receiving 1,190,280 direct marketing emails between 24 and 31 
July 2019. 


(2) The issues which have been identified in relation to the 51 
individuals who complained about having received emails from 
the Party in that period are inherently likely to have affected, at 
least, the 549,030 non-Party member recipients of those emails. 
This is, on any view, a substantial and serious number of likely 
affected individuals. That 51 recipients complained, and 
complained with legal justification, is itself an indicator of some 
significance in the context of unsolicited marketing email 


communications. 


(3) The Party failed to ensure that its records of those who had 
unsubscribed from its direct marketing communications were 
properly transferred when it changed its email provider, and it 


has been wholly unable to explain what occurred and why. 
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(4) During the course of the Commissioner's investigation, the Party 
proceeded to engage in an industrial-scale direct marketing email 
exercise during the 2019 General Election campaign, sending 
nearly 23 million emails. This generated a further 95 complaints 
to the Commissioner, which are likely to have resulted from the 
Party's failure to address the compliance issues identified in the 
Commissioner's investigation into the July 2019 email campaign 


and the wider audit of the Party's processing of personal data. 


The Commissioner has not identified any specific mitigating features in 
this case. Her acceptance that in at least the cases of Party member 
recipients of the 1,190,280 emails sent between 24-31 July 2019 
regulation 22 is likely to have been complied with is a reason why she 
has not found the full total to be a contravention: any emails which 
simply complied with the law cannot properly be identified as a 
mitigation. Although the Party did engage with the Commissioner's 
investigation and was not obstructive, its extensive delays in 
responding to requests for information and clarification mean that its 
conduct cannot be characterised as a mitigating factor, although the 


Commissioner does not find it to be an aggravating factor either. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking, and invited the Party to 


make representations in response. 


In reaching her final view, the Commissioner has taken into account 


representations made by the Party on this matter. 
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The Commissioner is accordingly entitled to issue a monetary penalty in 


this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on the Party. She has decided on the information that is 
available to her, that the Party has access to sufficient financial 
resources to pay the proposed monetary penalty without causing 
undue financial hardship, and without the monetary penalty posing any 
material risk to the Party's ability to participate in the democratic 
processes of the United Kingdom. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The sending of 
unsolicited marketing emails is a matter of significant public concern. A 
monetary penalty in this case should act as a general encouragement 
towards compliance with the law, or at least as a deterrent against 
non-compliance, on the part of all persons running businesses and 
other entities, such as political parties, currently engaging in these 
practices. The Commissioner's recent high-profile work in the 
processing of personal data by political parties and entities means that 
it is particularly important that clear instances of non-compliance be 
the subject of proportionate penalties. The issuing of a monetary 
penalty will reinforce the need for such bodies to ensure that they are 


only messaging those who specifically consent to receive marketing. 


The amount of the penalty 
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The Commissioner has not identified any direct comparators in her 

previous enforcement action, given the nature of the body in question 

and the nature of the contravention found. She has accordingly 

approached the setting of the penalty sum as a matter of principle, 

having regard to the need to ensure that the penalty is both dissuasive 


and proportionate in all the circumstances. 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £10,000 (ten thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 2 July 2021 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government's general bank account at 
the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
1 July 2021 the Commissioner will reduce the monetary penalty by 

20% to £8,000 (Eight thousand pounds). However, you should be 
aware that the early payment discount is not available if you decide to 


exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 


and/or; 
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(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 1% day of June 2021 


Andy Curry 

Head of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice has been served a right of appeal to 
the First-tier Tribunal (Information Rights) (the ‘Tribunal’) against the 
notice. 


2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 
at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 
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Telephone: 0300 123 4504 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 


b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 


rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you, 


Cc) the name and address of the Information Commissioner; 


d) details of the decision to which the proceedings relate; 


e) the result that you are seeking; 


f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal Must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


Before deciding whether or not to appeal you May wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may 
conduct his case himself or may be represented by any person whom 


he may appoint for that purpose. 


The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(5) of, and Schedule 
6 to, the Data Protection Act 1998, and Tribunal Procedure (First-tier 
Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory 
Instrument 2009 No. 1976 (L.20)). 
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